CVE-2024-46760: wifi: rtw88: usb: schedule rx work after everything is set up
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: usb: schedule rx work after everything is set up
Right now it's possible to hit NULL pointer dereference in rtwrxfillrxstatus on hw object and/or its fields because initialization routine can start getting USB replies before rtwdev is fully setup.
The stack trace looks like this:
rtwrxfillrxstatus rtw8821cqueryrxdesc rtwusbrxhandler ... queuework rtwusbreadportcomplete ... usbsubmiturb rtwusbrxresubmit rtwusbinitrx rtwusbprobe
So while we do the async stuff rtwusbprobe continues and calls rtwregisterhw, which does all kinds of initialization (e.g. via ieee80211registerhw) that rtwrxfillrxstatus relies on.
Fix this by moving the first usbsubmiturb after everything is set up.
For me, this bug manifested as: [ 8.893177] rtw8821cu 1-1:1.2: band wrong, packet dropped [ 8.910904] rtw8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtwrxfillrxstatus because I'm using Larry's backport of rtw88 driver with the NULL checks in rtwrxfillrxstatus.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46760?
The severity of CVE-2024-46760 is high due to the potential NULL pointer dereference.
How do I fix CVE-2024-46760?
To fix CVE-2024-46760, upgrade to Linux Kernel version 6.12.11-1 or later.
Which versions of the Linux Kernel are affected by CVE-2024-46760?
CVE-2024-46760 affects Linux Kernel versions prior to 6.6.51 and between 6.7 and 6.10.10.
What components are involved in CVE-2024-46760?
CVE-2024-46760 involves the wifi driver rtw88 and its initialization routine.
Is CVE-2024-46760 present in Debian Linux distributions?
Yes, CVE-2024-46760 is present in certain versions of Debian Linux prior to the recommended updates.